Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 09:00
Static task
static1
Behavioral task
behavioral1
Sample
power.ps1
Resource
win7v20201028
General
-
Target
power.ps1
-
Size
4KB
-
MD5
64d942a7c2e9dea577a1c062e6dc6bbd
-
SHA1
4b074b041c48ed8b4e1a175df1ff5dd5614d2c46
-
SHA256
7bec2a01478bd943f3752937e56ac6dcd8d4d702b2a7eb91dc97b531a732fa6d
-
SHA512
639cb9246fcda7046922a65408aa0fed462753398f24d030b5664f08bff27f3a0ba5e912568b6c78e7941633aa333b45296da3ff25e4f52a96c959bf016a6a71
Malware Config
Extracted
formbook
http://www.groupoperationltd.com/mph/
caravanmattressesforsale.com
romicalpk.com
procentrall.com
happyworkpro.com
barriobruja.com
olenfex.com
driftandcompile.com
heisen.club
materialmatch.online
maxmaldives.com
wzlxpscr.com
ytvksh.space
amonez.com
hatchmatchusa.com
mcfarlandfamilyevents.com
mcchoo.xyz
ravgugenheim.com
shapeshift.asia
defensebowl.store
styleliving.today
mediabullnews.com
puntplus.com
lazboylove.com
lavistamiddleschool.com
growgirlgrow.net
isohike.com
yuneimit.com
liquidflooringinternational.com
jobjori.com
growmeanairway.com
supportrightwinggear.com
irisgiladiphotography.com
gaditrack.com
biostaticwall.com
849nmaym.info
koottukudumbam.com
chosenmarketing.online
thekindnanny.com
pettitammo.com
simplymadphotography.com
tnx2u.com
musicoccaz.com
bikeemperor.com
jaimeirazabal.com
inlandtransporters.com
gorgereport.com
talasaz.com
hofmann.golf
atheraltwasl.com
richardestey.info
bees.photos
officialilluminati.net
vmxhmxgt.icu
evolutionhvac.net
koalavitamin.net
ldgstudio.com
naiyangresort.com
cudglebararabians.com
women-walk-camino.com
aendurance.net
ruggedmusclecoach.com
cudianxin.com
w-ciszy-serca.com
ostrimart.com
Signatures
-
Formbook Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/868-15-0x0000000000400000-0x000000000042E000-memory.dmp formbook behavioral1/memory/868-16-0x000000000041EB20-mapping.dmp formbook behavioral1/memory/1696-25-0x0000000000080000-0x00000000000AE000-memory.dmp formbook -
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exeflow pid process 8 792 powershell.exe 10 792 powershell.exe 12 792 powershell.exe 14 792 powershell.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
powershell.execontrol.exeNETSTAT.EXEdescription pid process target process PID 792 set thread context of 868 792 powershell.exe control.exe PID 868 set thread context of 1296 868 control.exe Explorer.EXE PID 868 set thread context of 1296 868 control.exe Explorer.EXE PID 1696 set thread context of 1296 1696 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1696 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
powershell.execontrol.exeNETSTAT.EXEpid process 792 powershell.exe 792 powershell.exe 792 powershell.exe 792 powershell.exe 792 powershell.exe 792 powershell.exe 792 powershell.exe 868 control.exe 868 control.exe 868 control.exe 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE 1696 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
control.exeNETSTAT.EXEpid process 868 control.exe 868 control.exe 868 control.exe 868 control.exe 1696 NETSTAT.EXE 1696 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes:
powershell.execontrol.exeExplorer.EXENETSTAT.EXEdescription pid process Token: SeDebugPrivilege 792 powershell.exe Token: SeIncreaseQuotaPrivilege 792 powershell.exe Token: SeSecurityPrivilege 792 powershell.exe Token: SeTakeOwnershipPrivilege 792 powershell.exe Token: SeLoadDriverPrivilege 792 powershell.exe Token: SeSystemProfilePrivilege 792 powershell.exe Token: SeSystemtimePrivilege 792 powershell.exe Token: SeProfSingleProcessPrivilege 792 powershell.exe Token: SeIncBasePriorityPrivilege 792 powershell.exe Token: SeCreatePagefilePrivilege 792 powershell.exe Token: SeBackupPrivilege 792 powershell.exe Token: SeRestorePrivilege 792 powershell.exe Token: SeShutdownPrivilege 792 powershell.exe Token: SeDebugPrivilege 792 powershell.exe Token: SeSystemEnvironmentPrivilege 792 powershell.exe Token: SeRemoteShutdownPrivilege 792 powershell.exe Token: SeUndockPrivilege 792 powershell.exe Token: SeManageVolumePrivilege 792 powershell.exe Token: 33 792 powershell.exe Token: 34 792 powershell.exe Token: 35 792 powershell.exe Token: SeIncreaseQuotaPrivilege 792 powershell.exe Token: SeSecurityPrivilege 792 powershell.exe Token: SeTakeOwnershipPrivilege 792 powershell.exe Token: SeLoadDriverPrivilege 792 powershell.exe Token: SeSystemProfilePrivilege 792 powershell.exe Token: SeSystemtimePrivilege 792 powershell.exe Token: SeProfSingleProcessPrivilege 792 powershell.exe Token: SeIncBasePriorityPrivilege 792 powershell.exe Token: SeCreatePagefilePrivilege 792 powershell.exe Token: SeBackupPrivilege 792 powershell.exe Token: SeRestorePrivilege 792 powershell.exe Token: SeShutdownPrivilege 792 powershell.exe Token: SeDebugPrivilege 792 powershell.exe Token: SeSystemEnvironmentPrivilege 792 powershell.exe Token: SeRemoteShutdownPrivilege 792 powershell.exe Token: SeUndockPrivilege 792 powershell.exe Token: SeManageVolumePrivilege 792 powershell.exe Token: 33 792 powershell.exe Token: 34 792 powershell.exe Token: 35 792 powershell.exe Token: SeDebugPrivilege 868 control.exe Token: SeShutdownPrivilege 1296 Explorer.EXE Token: SeDebugPrivilege 1696 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE 1296 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
powershell.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 792 wrote to memory of 868 792 powershell.exe control.exe PID 792 wrote to memory of 868 792 powershell.exe control.exe PID 792 wrote to memory of 868 792 powershell.exe control.exe PID 792 wrote to memory of 868 792 powershell.exe control.exe PID 792 wrote to memory of 868 792 powershell.exe control.exe PID 792 wrote to memory of 868 792 powershell.exe control.exe PID 792 wrote to memory of 868 792 powershell.exe control.exe PID 1296 wrote to memory of 1696 1296 Explorer.EXE NETSTAT.EXE PID 1296 wrote to memory of 1696 1296 Explorer.EXE NETSTAT.EXE PID 1296 wrote to memory of 1696 1296 Explorer.EXE NETSTAT.EXE PID 1296 wrote to memory of 1696 1296 Explorer.EXE NETSTAT.EXE PID 1696 wrote to memory of 2032 1696 NETSTAT.EXE cmd.exe PID 1696 wrote to memory of 2032 1696 NETSTAT.EXE cmd.exe PID 1696 wrote to memory of 2032 1696 NETSTAT.EXE cmd.exe PID 1696 wrote to memory of 2032 1696 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\power.ps12⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\syswow64\control.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\WINDOWS\syswow64\control.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/792-14-0x000000001B800000-0x000000001B845000-memory.dmpFilesize
276KB
-
memory/792-11-0x000000001AB30000-0x000000001AB31000-memory.dmpFilesize
4KB
-
memory/792-2-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmpFilesize
8KB
-
memory/792-5-0x000000001AC40000-0x000000001AC41000-memory.dmpFilesize
4KB
-
memory/792-6-0x0000000002320000-0x0000000002321000-memory.dmpFilesize
4KB
-
memory/792-7-0x000000001ABC0000-0x000000001ABC2000-memory.dmpFilesize
8KB
-
memory/792-8-0x000000001ABC4000-0x000000001ABC6000-memory.dmpFilesize
8KB
-
memory/792-9-0x0000000001E40000-0x0000000001E41000-memory.dmpFilesize
4KB
-
memory/792-10-0x000000001C720000-0x000000001C721000-memory.dmpFilesize
4KB
-
memory/792-3-0x000007FEF5940000-0x000007FEF632C000-memory.dmpFilesize
9.9MB
-
memory/792-12-0x000000001ABCA000-0x000000001ABE9000-memory.dmpFilesize
124KB
-
memory/792-4-0x000000001A8E0000-0x000000001A8E1000-memory.dmpFilesize
4KB
-
memory/868-15-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/868-21-0x0000000000210000-0x0000000000224000-memory.dmpFilesize
80KB
-
memory/868-16-0x000000000041EB20-mapping.dmp
-
memory/868-19-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/868-18-0x0000000000A80000-0x0000000000D83000-memory.dmpFilesize
3.0MB
-
memory/1296-29-0x0000000006FA0000-0x00000000070FF000-memory.dmpFilesize
1.4MB
-
memory/1296-20-0x0000000004220000-0x0000000004379000-memory.dmpFilesize
1.3MB
-
memory/1296-22-0x0000000006C50000-0x0000000006DCB000-memory.dmpFilesize
1.5MB
-
memory/1596-13-0x000007FEF63D0000-0x000007FEF664A000-memory.dmpFilesize
2.5MB
-
memory/1696-23-0x0000000000000000-mapping.dmp
-
memory/1696-24-0x0000000000840000-0x0000000000849000-memory.dmpFilesize
36KB
-
memory/1696-25-0x0000000000080000-0x00000000000AE000-memory.dmpFilesize
184KB
-
memory/1696-27-0x0000000002170000-0x0000000002473000-memory.dmpFilesize
3.0MB
-
memory/1696-28-0x0000000001DE0000-0x0000000001E73000-memory.dmpFilesize
588KB
-
memory/2032-26-0x0000000000000000-mapping.dmp